ETHEREUM SEPOLIA · ONE REAL EXECUTION

gavel

Safe splits a multisig transaction into two acts that are not the same act. Signing happens off-chain, free. Executing costs gas, can be done by anyone, and is nobody's job. gavel is the party whose job it is.

Open the 10-slide deck → v1.0.0

The two acts

Signing

Off-chain, in the Safe Transaction Service. Free. The owners already did it — that is why the transaction is in the queue at all.

● Already happened
then

Executing

On-chain execTransaction. Costs gas. Permissionless — anyone may call it. Assigned to no one, so it does not happen.

▲ Nobody's job

The finding this is built on

92.6% already dead

Every square is one queued Base transaction that passes the naive “threshold met, not executed” test.

Squares partition the 366; the funnel below nests them. 21 + 4 + 2 = the 27 live, and 4 + 2 = the 6 at their Safe's current nonce.

1,299Base Safes surveyed, across all of Base history
366queued transactions match the naive “ready to execute” test
339nonce already consumed — permanently dead (92.6%)
27still live
6at their Safe's current nonce
2simulate SUCCESS

A detector built on the obvious definition is ~93% false positives. Anyone can concatenate signatures; knowing which 7.4% are real is the product. Method and per-Safe detail are in the repository README.

Verify it yourself — five surfaces, none of them ours

  1. Open the transaction Status Success · 144,637 gas · block 11618878
  2. On that page open Logs A Safe ExecutionSuccess and a USDC Transfer of 10.000000 — value moved
  3. Read the Safe's contract → isOwner → 0x5E2e5Fd3aD7fDC9B94482930db8b5F45E439bab7 Returns false. The executor owns nothing on the Safe it drained.
  4. Same contract → nonce Advanced past the transaction we executed — it is genuinely consumed, not merely proposed
  5. Read the code — src/assemble.mjs is the entire decision surface npm test · 80 tests, 100% line and branch coverage on the decision surface, one of which runs against a committed real Safe Transaction Service response
The sender will look wrong, and here is why before you wonder.
KeeperHub writes are gas-sponsored, so a relayer submits and the top-level From is an address you will not recognise. But eth_getCode on our executor returns 0xef0100… — an EIP-7702 delegation designator. The delegate runs in the EOA's own context, so msg.sender at the Safe is still the executor. Verify by transaction hash, not by address history.

What is not done

No mainnet execution yet. Everything above is Ethereum Sepolia. EVIDENCE.md is absent by design, not empty by accident — scripts/audit.mjs refuses to write a row from a chain marked receiptsEligible: false.

The workflow is not deployed. code/run-code and HTTP Request require a paid KeeperHub plan. scripts/drain.mjs reaches the same on-chain outcome through the Direct Execution API, which is not gated — but it decides here and asks KeeperHub to execute, rather than deciding inside KeeperHub. That is a weaker answer and we are not going to blur it.

No demo video, no Hub publication, no Marketplace listing as of this page's last update.